popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name e3b0c44298fc1c14_cerF963.tmp
Empty file or file not found
Filepath C:\Windows\cerF963.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 17f746d82695fa9b_alpha.exe
Submit file
Filepath C:\Users\Public\alpha.exe
Size 295.5KB
Processes 2836 (extrac32.exe) 2704 (cmd.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 ad7b9c14083b52bc532fba5948342b98
SHA1 ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA256 17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
CRC32 C1BA11D1
ssdeep 3072:H/Fkbff/FoeMrx9O1vfjQdLCQMcP7FRCMkLjyGez1c:H9kbtoLtM1nM9xf/CMkLmt+
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 0395b1e766415e2e_ping_c.pif
Submit file
Filepath C:\Users\Public\Libraries\Ping_c.pif
Size 1.4MB
Processes 2984 (kn.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4ffb32f1690aa831e132e381df519300
SHA1 ae6e6a6b561b901d97479ad960888fecf08c5519
SHA256 0395b1e766415e2e204294ea212d9dc95e5f69eb142ae347a0c9903a5e56c71d
CRC32 67014D83
ssdeep 24576:h4QdcyXLJzOXVbl/41acOSYrkjX/Mv4L2z3/7zXedU+rcuDYm+7etOY7OhWP6PZk:CQ/yF41acOSrYvZzv8+fm+7etlWWP4Cp
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • mzp_file_format - MZP(Delphi) file format
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 6c05e11399b7e3c8_xkn.exe
Submit file
Filepath C:\Users\Public\xkn.exe
Size 442.0KB
Processes 2228 (extrac32.exe) 192 (alpha.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 92f44e405db16ac55d97e3bfe3b132fa
SHA1 04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA256 6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
CRC32 73932221
ssdeep 6144:+FYRyCXBgoDhzoNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqOm:dRZgQhIKXzJ4pdd3klnnWosPhnzqN
Yara
  • PE_Header_Zero - PE File Signature
  • Antivirus - Contains references to security software
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name b2628395d5ba5a6b_Ping_c.mp4
Submit file
Filepath C:\Users\Public\Ping_c.mp4
Size 2.8MB
Processes 1964 (kn.exe) 2080 (alpha.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 9127217563d01e011becab066e5c49d3
SHA1 e8ee9e6c3bdfd6f7bc8dad7713261881f18f37d8
SHA256 b2628395d5ba5a6b6657cd1ef351b18dd322d6ed864c38ed6584c27529140e03
CRC32 489BDB8B
ssdeep 24576:UIjMKEr6BetTyfzJjCa3RWakbq9Pjmw5i2FE2Ms6DOl4JG3vlfzu7xTQL:x
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
  • anti_vm_detect - Possibly employs anti-virtualization techniques
VirusTotal Search for analysis
Name 36414c7e57afa613_ger.exe
Submit file
Filepath C:\Users\Public\ger.exe
Size 61.0KB
Processes 2136 (extrac32.exe) 2896 (alpha.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 d69a9abbb0d795f21995c2f48c1eb560
SHA1 8bd131b03d6ba865b228ca8ee3239d2ef2b90b74
SHA256 36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a
CRC32 872C1B2B
ssdeep 1536:LB9b/srNIktO/LayPO6lZtmVE7JvpUcuLgpq064Qk:HLsrStJPuLgE06t
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 589229e2bd931000_kn.exe
Submit file
Filepath C:\Users\Public\kn.exe
Size 869.0KB
Processes 3016 (extrac32.exe) 3036 (alpha.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 7b973145f7e1b59330ca4dd1f86b3d55
SHA1 10ce9174bff4856083e6adad0094a798ced2c079
SHA256 589229e2bd93100049909edf9825dce24ff963a0c465d969027db34e2eb878b4
CRC32 6F3940A1
ssdeep 24576:gLByfEWXrGU3Vrzll/POE7gLtk+oOg3uOvb725m:gV+iU3j7chk+w39z79
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis